What Is GDPR?

The General Data Protection Regulation governs the processing of personal data relating to people in the European Union and European Economic Area. It applies regardless of where the organisation doing the processing is located.

That extraterritorial reach is why it matters to organisations with no European presence: offering goods or services to people in the region, or monitoring their behaviour, brings you within scope.

Lawful basis is the structural difference

Every processing activity requires a lawful basis — consent, contract, legal obligation, vital interests, public task or legitimate interests. This is the concept most often missing from other privacy regimes and the one organisations most frequently get wrong.

Consent is only one basis and is the most demanding: freely given, specific, informed, unambiguous and withdrawable. Relying on it where another basis would apply creates an obligation to stop processing whenever someone objects.

The individual rights

Access, rectification, erasure, restriction, portability, objection, and rights concerning automated decision-making. Each carries response deadlines, generally one month.

Meeting them operationally requires knowing where personal data lives, which is why a data inventory is the practical foundation. Organisations that cannot locate an individual's data across their systems cannot satisfy these rights whatever their policy says.

Breach notification runs on a short clock

Notification to the supervisory authority within seventy-two hours of becoming aware, where there is a risk to individuals, and notification to the individuals themselves where the risk is high.

The clock starts at awareness, not at conclusion of the investigation, which is the detail most often misunderstood. See breach response.

Controllers, processors and contracts

A controller determines why and how data is processed; a processor acts on the controller's instructions. The distinction determines obligations and liability.

Contracts between them are mandatory and prescriptive about what they must contain. Sub-processors require authorisation, which means the chain of vendors behind your vendor is your concern.

International transfers

Moving personal data outside the region requires a transfer mechanism: an adequacy decision covering the destination, standard contractual clauses, or binding corporate rules.

Contractual clauses also require an assessment of whether the destination's laws undermine the protection, which is a substantive exercise rather than a signature. This area has changed repeatedly and is worth checking rather than assuming.

Records of processing and the accountability principle

The regulation requires organisations to demonstrate compliance rather than merely achieve it, and the record of processing activities is the primary evidence: what data, for what purpose, on what basis, shared with whom, retained how long.

Supervisory authorities request it early in any investigation, and its absence is treated as a failure in its own right. It is also the artefact that makes everything else — rights requests, breach scoping, retention — operationally possible.

Data protection by design and by default is a requirement rather than a principle, which means privacy considerations belong in system design rather than in a review before launch. A privacy impact assessment is mandatory where processing is likely to present high risk, and it is expected before the processing begins rather than afterwards. See privacy impact assessment.

Where to start

Document the lawful basis for your three largest processing activities. If that is difficult, the difficulty is the finding and everything else follows from it.

See PIPEDA versus GDPR. GuardsArm delivers GDPR compliance.